@promptci/core 0.1.0 → 0.2.1

package/dist/git-symlinks.js

@@ -0,0 +1,161 @@
+/**
+ * Does git say a path is a symlink?
+ *
+ * A checkout without symlink support (Windows without `core.symlinks`) writes a
+ * committed link as a small regular file holding the target path. The scanner
+ * only treats such a file as a link when the repository itself says it is one,
+ * so a hand-written one-line pointer file stays a real file:
+ *
+ *  1. the index (`.git/index`, versions 2 and 3) records the path with mode
+ *     120000 — authoritative when it can be read: the path is a link exactly
+ *     when its entry has that mode;
+ *  2. otherwise the repository's own config has `core.symlinks = false` (the
+ *     setting git writes at clone time on a filesystem that cannot link). The
+ *     global and system config are deliberately not consulted: they say what a
+ *     clone would do, not what this checkout is.
+ *
+ * Read-only, no git binary, no network. Anything unreadable or unrecognised
+ * answers "no".
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+const MAX_CONFIG_BYTES = 1024 * 1024;
+const MAX_INDEX_BYTES = 128 * 1024 * 1024;
+const MAX_INDEX_ENTRIES = 2_000_000;
+const MAX_PARENT_LEVELS = 24;
+/** The repository (work tree, git dir, common dir) containing `start`, or undefined. */
+function findGit(start) {
+    let dir = path.resolve(start);
+    for (let level = 0; level < MAX_PARENT_LEVELS; level++) {
+        const dotGit = path.join(dir, '.git');
+        try {
+            const stat = fs.statSync(dotGit);
+            if (stat.isDirectory())
+                return { workTree: dir, gitDir: dotGit, commonDir: dotGit };
+            if (stat.isFile() && stat.size < 4096) {
+                // A linked worktree or submodule: `.git` is a file `gitdir: <path>`.
+                const pointer = /^gitdir:\s*(.+?)\s*$/m.exec(fs.readFileSync(dotGit, 'utf8'))?.[1];
+                if (pointer) {
+                    const gitDir = path.resolve(dir, pointer);
+                    let commonDir = gitDir;
+                    try {
+                        const common = fs.readFileSync(path.join(gitDir, 'commondir'), 'utf8').trim();
+                        if (common)
+                            commonDir = path.resolve(gitDir, common);
+                    }
+                    catch {
+                        // not a linked worktree
+                    }
+                    return { workTree: dir, gitDir, commonDir };
+                }
+            }
+        }
+        catch {
+            // no `.git` here: keep climbing
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return undefined;
+}
+/** `core.symlinks` from a git config file's text: false only when the last value says so. */
+export function configDisablesSymlinks(config) {
+    let inCore = false;
+    let value;
+    for (const raw of config.split(/\r?\n/)) {
+        const line = raw.trim();
+        const section = /^\[\s*([A-Za-z0-9.-]+)(?:\s+"[^"]*")?\s*\]/.exec(line);
+        if (section) {
+            inCore = section[1].toLowerCase() === 'core' && !line.includes('"');
+            continue;
+        }
+        if (!inCore)
+            continue;
+        const key = /^symlinks\s*(?:=\s*(.*?))?\s*(?:[;#].*)?$/i.exec(line);
+        if (key)
+            value = key[1] === undefined ? 'true' : key[1].replace(/^"|"$/g, '').trim();
+    }
+    return value !== undefined && /^(?:false|no|off|0)$/i.test(value);
+}
+/** The paths of a git index (versions 2 and 3) whose entry mode is a symlink; undefined when unreadable or another version. */
+export function symlinkPathsInIndex(index) {
+    if (index.length < 12 || index.toString('latin1', 0, 4) !== 'DIRC')
+        return undefined;
+    const version = index.readUInt32BE(4);
+    if (version !== 2 && version !== 3)
+        return undefined;
+    const count = index.readUInt32BE(8);
+    if (count > MAX_INDEX_ENTRIES)
+        return undefined;
+    const links = new Set();
+    let offset = 12;
+    for (let n = 0; n < count; n++) {
+        if (offset + 62 > index.length)
+            return undefined;
+        const mode = index.readUInt32BE(offset + 24);
+        const flags = index.readUInt16BE(offset + 60);
+        const extended = version === 3 && (flags & 0x4000) !== 0;
+        const fixed = extended ? 64 : 62;
+        let nameLength = flags & 0x0fff;
+        if (nameLength === 0x0fff) {
+            const nul = index.indexOf(0, offset + fixed);
+            if (nul < 0)
+                return undefined;
+            nameLength = nul - (offset + fixed);
+        }
+        if (offset + fixed + nameLength > index.length)
+            return undefined;
+        if ((mode & 0o170000) === 0o120000)
+            links.add(index.toString('utf8', offset + fixed, offset + fixed + nameLength));
+        offset += Math.ceil((fixed + nameLength + 1) / 8) * 8;
+    }
+    return links;
+}
+/** Built lazily by the caller: nothing is read until the first question. */
+export function createGitSymlinkOracle(scanRoot) {
+    let loaded;
+    const load = () => {
+        if (loaded !== undefined)
+            return loaded;
+        loaded = null;
+        const git = findGit(scanRoot);
+        if (!git)
+            return loaded;
+        let configFalse = false;
+        try {
+            const configPath = path.join(git.commonDir, 'config');
+            if (fs.statSync(configPath).size <= MAX_CONFIG_BYTES)
+                configFalse = configDisablesSymlinks(fs.readFileSync(configPath, 'utf8'));
+        }
+        catch {
+            // no readable config
+        }
+        let links;
+        try {
+            const indexPath = path.join(git.gitDir, 'index');
+            if (fs.statSync(indexPath).size <= MAX_INDEX_BYTES)
+                links = symlinkPathsInIndex(fs.readFileSync(indexPath));
+        }
+        catch {
+            // no readable index
+        }
+        loaded = { git, links, configFalse };
+        return loaded;
+    };
+    return {
+        isSymlink(scanRelativePath) {
+            const state = load();
+            if (!state)
+                return false;
+            // The index is authoritative when it parsed: the path is a link exactly when its entry says so.
+            if (state.links) {
+                const gitRelative = path.relative(state.git.workTree, path.resolve(scanRoot, scanRelativePath)).split(path.sep).join('/');
+                return state.links.has(gitRelative);
+            }
+            return state.configFalse;
+        },
+    };
+}
+//# sourceMappingURL=git-symlinks.js.map

package/dist/git-symlinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-symlinks.js","sourceRoot":"","sources":["../src/git-symlinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,MAAM,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAAC;AACrC,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAC1C,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAI7B,wFAAwF;AACxF,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,iBAAiB,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;YACpF,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC;gBACtC,qEAAqE;gBACrE,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACnF,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBAC1C,IAAI,SAAS,GAAG,MAAM,CAAC;oBACvB,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;wBAC9E,IAAI,MAAM;4BAAE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;oBACvD,CAAC;oBAAC,MAAM,CAAC;wBACP,wBAAwB;oBAC1B,CAAC;oBACD,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,GAAG;YAAE,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACrF,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,GAAG,iBAAiB;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,IAAI,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,IAAI,UAAU,GAAG,KAAK,GAAG,MAAM,CAAC;QAChC,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;YAC7C,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9B,UAAU,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,KAAK,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,QAAQ;YAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC;QACnH,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,4EAA4E;AAC5E,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,IAAI,MAAqG,CAAC;IAE1G,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACxC,MAAM,GAAG,IAAI,CAAC;QACd,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,OAAO,MAAM,CAAC;QACxB,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YACtD,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI,gBAAgB;gBAAE,WAAW,GAAG,sBAAsB,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAClI,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;QACD,IAAI,KAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,eAAe;gBAAE,KAAK,GAAG,mBAAmB,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9G,CAAC;QAAC,MAAM,CAAC;YACP,oBAAoB;QACtB,CAAC;QACD,MAAM,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,SAAS,CAAC,gBAAgB;YACxB,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,gGAAgG;YAChG,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC1H,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,KAAK,CAAC,WAAW,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/gitignore.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Minimal `.gitignore` matching for "is this referenced file expected to be
+ * absent from a checkout?" questions.
+ *
+ * A reference to `.beads/issues.jsonl` or `/data/app.db` is not broken when the
+ * repository's own ignore rules say the file is local, generated state. This
+ * reads the `.gitignore` files on the path from the repo root down to the file
+ * (nested ignore files apply to their own directory) and evaluates them the way
+ * git does: within one file the last matching rule wins, a deeper file overrides
+ * a shallower one, and a file under an ignored directory is ignored. It does not
+ * read `.git/info/exclude` or the user's global excludes file — only what the
+ * repository itself commits.
+ *
+ * Patterns are translated to regular expressions with gitignore's own glob
+ * dialect (`*`, `?`, `[...]`, `**`, backslash escapes). They are deliberately
+ * NOT handed to a general-purpose glob library: braces, extglobs (`+(a|b)`),
+ * a leading `!` after an escape, and `#` mean something different there than
+ * they do to git, which treats them literally.
+ */
+/** Build a checker over one repository; ignore files are read lazily and once each. */
+export declare function createGitIgnoreChecker(repoRoot: string): (repoRelativePath: string) => boolean;
+//# sourceMappingURL=gitignore.d.ts.map

package/dist/gitignore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.d.ts","sourceRoot":"","sources":["../src/gitignore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA2GH,uFAAuF;AACvF,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,gBAAgB,EAAE,MAAM,KAAK,OAAO,CA4B9F"}

package/dist/gitignore.js

@@ -0,0 +1,157 @@
+/**
+ * Minimal `.gitignore` matching for "is this referenced file expected to be
+ * absent from a checkout?" questions.
+ *
+ * A reference to `.beads/issues.jsonl` or `/data/app.db` is not broken when the
+ * repository's own ignore rules say the file is local, generated state. This
+ * reads the `.gitignore` files on the path from the repo root down to the file
+ * (nested ignore files apply to their own directory) and evaluates them the way
+ * git does: within one file the last matching rule wins, a deeper file overrides
+ * a shallower one, and a file under an ignored directory is ignored. It does not
+ * read `.git/info/exclude` or the user's global excludes file — only what the
+ * repository itself commits.
+ *
+ * Patterns are translated to regular expressions with gitignore's own glob
+ * dialect (`*`, `?`, `[...]`, `**`, backslash escapes). They are deliberately
+ * NOT handed to a general-purpose glob library: braces, extglobs (`+(a|b)`),
+ * a leading `!` after an escape, and `#` mean something different there than
+ * they do to git, which treats them literally.
+ */
+import { readTextWithinRoot } from './ai-config.js';
+function escapeRegex(ch) {
+    return /[\\^$.*+?()[\]{}|/]/.test(ch) ? `\\${ch}` : ch;
+}
+/** Translate a gitignore glob (no leading `/`, no trailing `/`) to an anchored RegExp source. */
+function globToRegexSource(glob) {
+    let out = '';
+    let i = 0;
+    while (i < glob.length) {
+        const ch = glob[i];
+        if (ch === '\\') {
+            // A backslash makes the next character literal.
+            if (i + 1 < glob.length)
+                out += escapeRegex(glob[i + 1]);
+            i += 2;
+        }
+        else if (ch === '*') {
+            if (glob[i + 1] === '*') {
+                const atStart = i === 0 || glob[i - 1] === '/';
+                let end = i + 2;
+                while (glob[end] === '*')
+                    end++;
+                if (atStart && glob[end] === '/') {
+                    out += '(?:.*/)?'; // `**/` — zero or more directories
+                    i = end + 1;
+                }
+                else if (atStart && end === glob.length) {
+                    out += '.*'; // trailing `/**` (the slash is already emitted) — everything below
+                    i = end;
+                }
+                else {
+                    out += '[^/]*'; // `**` not bounded by slashes behaves like `*`
+                    i = end;
+                }
+            }
+            else {
+                out += '[^/]*';
+                i++;
+            }
+        }
+        else if (ch === '?') {
+            out += '[^/]';
+            i++;
+        }
+        else if (ch === '[') {
+            const close = glob.indexOf(']', i + 2); // `[]x]` / `[!]x]` make the first `]` a member
+            if (close === -1) {
+                out += '\\[';
+                i++;
+            }
+            else {
+                let body = glob.slice(i + 1, close);
+                let negated = false;
+                if (body.startsWith('!') || body.startsWith('^')) {
+                    negated = true;
+                    body = body.slice(1);
+                }
+                body = body.replace(/[\\^\]]/g, (c) => `\\${c}`);
+                out += `[${negated ? '^' : ''}${body}]`;
+                i = close + 1;
+            }
+        }
+        else {
+            out += escapeRegex(ch);
+            i++;
+        }
+    }
+    return out;
+}
+function parseRules(content) {
+    const rules = [];
+    for (const raw of content.split(/\r?\n/)) {
+        // Unescaped trailing spaces are dropped; `foo\ ` keeps its space.
+        let line = raw.replace(/(?<!\\)[ \t]+$/, '');
+        if (line === '' || line.startsWith('#'))
+            continue; // `\#file` starts with a backslash, not `#`
+        let negate = false;
+        if (line.startsWith('!')) {
+            negate = true;
+            line = line.slice(1);
+        }
+        // `\!file` and `\#file`: the backslash stays in the glob, where it reads as an escape.
+        let dirOnly = false;
+        if (line.endsWith('/')) {
+            dirOnly = true;
+            line = line.slice(0, -1);
+        }
+        const anchored = line.includes('/');
+        line = line.replace(/^\//, '');
+        if (line === '')
+            continue;
+        try {
+            rules.push({ negate, dirOnly, anchored, regex: new RegExp(`^${globToRegexSource(line)}$`) });
+        }
+        catch {
+            // An unparseable pattern is skipped, as git would warn about and ignore it.
+        }
+    }
+    return rules;
+}
+function ruleMatches(rule, pathBelowIgnoreFile, isDir) {
+    if (rule.dirOnly && !isDir)
+        return false;
+    const target = rule.anchored ? pathBelowIgnoreFile : pathBelowIgnoreFile.split('/').pop();
+    return rule.regex.test(target);
+}
+/** Build a checker over one repository; ignore files are read lazily and once each. */
+export function createGitIgnoreChecker(repoRoot) {
+    const cache = new Map();
+    const rulesFor = (dir) => {
+        let rules = cache.get(dir);
+        if (!rules) {
+            const content = readTextWithinRoot(repoRoot, dir === '' ? '.gitignore' : `${dir}/.gitignore`);
+            rules = content === undefined ? [] : parseRules(content);
+            cache.set(dir, rules);
+        }
+        return rules;
+    };
+    return (repoRelativePath) => {
+        const segments = repoRelativePath.replace(/\\/g, '/').replace(/^\.\//, '').split('/').filter(Boolean);
+        for (let end = 1; end <= segments.length; end++) {
+            const isDir = end < segments.length; // every prefix but the last is a directory
+            let ignored;
+            for (let start = 0; start < end; start++) {
+                const below = segments.slice(start, end).join('/');
+                for (const rule of rulesFor(segments.slice(0, start).join('/'))) {
+                    if (ruleMatches(rule, below, isDir))
+                        ignored = !rule.negate;
+                }
+            }
+            // An ignored directory cannot be re-included, so everything below it is ignored too.
+            if (ignored === true)
+                return true;
+        }
+        return false;
+    };
+}
+//# sourceMappingURL=gitignore.js.map

package/dist/gitignore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitignore.js","sourceRoot":"","sources":["../src/gitignore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAUpD,SAAS,WAAW,CAAC,EAAU;IAC7B,OAAO,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,iGAAiG;AACjG,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,gDAAgD;YAChD,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,CAAC;YAC1D,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAC/C,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG;oBAAE,GAAG,EAAE,CAAC;gBAChC,IAAI,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;oBACjC,GAAG,IAAI,UAAU,CAAC,CAAC,mCAAmC;oBACtD,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;gBACd,CAAC;qBAAM,IAAI,OAAO,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC1C,GAAG,IAAI,IAAI,CAAC,CAAC,mEAAmE;oBAChF,CAAC,GAAG,GAAG,CAAC;gBACV,CAAC;qBAAM,CAAC;oBACN,GAAG,IAAI,OAAO,CAAC,CAAC,+CAA+C;oBAC/D,CAAC,GAAG,GAAG,CAAC;gBACV,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,OAAO,CAAC;gBACf,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,GAAG,IAAI,MAAM,CAAC;YACd,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,+CAA+C;YACvF,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,GAAG,IAAI,KAAK,CAAC;gBACb,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,CAAC;gBACN,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;gBACpC,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjD,OAAO,GAAG,IAAI,CAAC;oBACf,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,CAAC;gBACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACjD,GAAG,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,GAAG,CAAC;gBACxC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;YACvB,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,kEAAkE;QAClE,IAAI,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,4CAA4C;QAC/F,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,uFAAuF;QACvF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,4EAA4E;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,IAAU,EAAE,mBAA2B,EAAE,KAAc;IAC1E,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;IAC3F,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAU,EAAE;QACvC,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,GAAG,aAAa,CAAC,CAAC;YAC9F,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,OAAO,CAAC,gBAAwB,EAAW,EAAE;QAC3C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtG,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,2CAA2C;YAChF,IAAI,OAA4B,CAAC;YACjC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAChE,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;wBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC9D,CAAC;YACH,CAAC;YACD,qFAAqF;YACrF,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/health-score.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health-score.d.ts","sourceRoot":"","sources":["../src/health-score.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAgC,aAAa,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAyBtF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAoBlE;AAQD;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAiE9E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CAuChE"}
+{"version":3,"file":"health-score.d.ts","sourceRoot":"","sources":["../src/health-score.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAgC,aAAa,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAuDtF;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAoBlE;AAQD;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAiE9E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CAuChE"}

package/dist/health-score.js

@@ -25,6 +25,35 @@ const CATEGORY_DEDUCTION_CAP = {
     vague_guidance: 10,
     ai_config: 25, // skills/subagents/hooks/mcp/cursor config checks
 };
+/**
+ * Deduction caps for groups that cut across a category. Each tagged group
+ * gets its own bucket; the rest of the `security` category stays uncapped.
+ *
+ * - `supply-chain` (8): unpinned GitHub Actions are `security` findings, but
+ *   they describe CI configuration, not instruction health: uncapped, one
+ *   finding per unpinned action took ~25 points off an otherwise healthy repo
+ *   that simply uses tag-pinned third-party actions.
+ * - `skill-supply-chain` (15): findings about installed third-party skills,
+ *   not the repo's own instruction health: uncapped, one noisy skill could
+ *   zero an otherwise healthy score.
+ *
+ * Capped, they stay visible (and still sort into top fixes by severity, and
+ * `--fail-on high` still gates CI on them) without dominating the score.
+ */
+const TAG_DEDUCTION_CAP = {
+    'supply-chain': 8,
+    'skill-supply-chain': 15,
+};
+/** The cap bucket an issue's deduction counts against, if any. */
+function deductionBucket(issue) {
+    for (const tag of issue.tags ?? []) {
+        const cap = TAG_DEDUCTION_CAP[tag];
+        if (cap !== undefined)
+            return { key: `tag:${tag}`, cap };
+    }
+    const cap = CATEGORY_DEDUCTION_CAP[issue.category];
+    return cap !== undefined ? { key: issue.category, cap } : undefined;
+}
 /**
  * Compute a health score from 0–100 based on issue severity and confidence.
  *
@@ -39,12 +68,12 @@ export function computeHealthScore(issues) {
     const categoryDeductions = new Map();
     for (const issue of issues) {
         const deduction = (SEVERITY_WEIGHT[issue.severity] ?? 0) * issue.confidence;
-        const cap = CATEGORY_DEDUCTION_CAP[issue.category];
-        if (cap !== undefined) {
-            const soFar = categoryDeductions.get(issue.category) ?? 0;
-            const allowed = Math.max(0, cap - soFar);
+        const bucket = deductionBucket(issue);
+        if (bucket !== undefined) {
+            const soFar = categoryDeductions.get(bucket.key) ?? 0;
+            const allowed = Math.max(0, bucket.cap - soFar);
             const actual = Math.min(deduction, allowed);
-            categoryDeductions.set(issue.category, soFar + actual);
+            categoryDeductions.set(bucket.key, soFar + actual);
             score -= actual;
         }
         else {

package/dist/health-score.js.map

@@ -1 +1 @@
-{"version":3,"file":"health-score.js","sourceRoot":"","sources":["../src/health-score.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,eAAe,GAAkC;IACrD,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAA2C;IACrE,SAAS,EAAE,EAAE,EAAW,kBAAkB;IAC1C,iBAAiB,EAAE,EAAE;IACrB,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,EAAE;IAClB,SAAS,EAAE,EAAE,EAAW,kDAAkD;CAC3E,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAuB;IACxD,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;QAC5E,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEnD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC5C,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;YACvD,KAAK,IAAI,MAAM,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,aAAa,GAA8C;IAC/D,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACP,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAEtC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAExC,gCAAgC;IAChC,IACE,GAAG,KAAK,UAAU;QAClB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC1B,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC9B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yCAAyC;IACzC,IACE,GAAG,KAAK,kBAAkB;QAC1B,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC5B,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wBAAwB;IACxB,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8CAA8C;IAC9C,IACE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC1B,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6CAA6C;IAC7C,IACE,GAAG,KAAK,iBAAiB;QACzB,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC9B,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC5B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yCAAyC;IACzC,IAAI,GAAG,KAAK,gBAAgB,IAAI,GAAG,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9G,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,MAAuB;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,UAAU,GACd,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAExC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QAC7C,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAEpC,MAAM,UAAU,GACd,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAExC,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;QAC1D,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEtC,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAElC,OAAO,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;YAAE,MAAM;QAC7B,gFAAgF;QAChF,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEnC,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,eAAe,EAAE,KAAK,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"health-score.js","sourceRoot":"","sources":["../src/health-score.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,eAAe,GAAkC;IACrD,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAA2C;IACrE,SAAS,EAAE,EAAE,EAAW,kBAAkB;IAC1C,iBAAiB,EAAE,EAAE;IACrB,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,EAAE;IAClB,SAAS,EAAE,EAAE,EAAW,kDAAkD;CAC3E,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,iBAAiB,GAA2B;IAChD,cAAc,EAAE,CAAC;IACjB,oBAAoB,EAAE,EAAE;CACzB,CAAC;AAEF,kEAAkE;AAClE,SAAS,eAAe,CAAC,KAAoB;IAC3C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAuB;IACxD,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAErD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;QAC5E,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAEtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC5C,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;YACnD,KAAK,IAAI,MAAM,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,aAAa,GAA8C;IAC/D,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;CACP,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAEtC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAExC,gCAAgC;IAChC,IACE,GAAG,KAAK,UAAU;QAClB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC1B,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC9B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yCAAyC;IACzC,IACE,GAAG,KAAK,kBAAkB;QAC1B,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACtB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC5B,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,wBAAwB;IACxB,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACjH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,8CAA8C;IAC9C,IACE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC1B,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,KAAK,CAAC,QAAQ,CAAC,0BAA0B,CAAC,EAC1C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,6CAA6C;IAC7C,IACE,GAAG,KAAK,iBAAiB;QACzB,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC9B,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QACzB,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC5B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,yCAAyC;IACzC,IAAI,GAAG,KAAK,gBAAgB,IAAI,GAAG,KAAK,WAAW,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9G,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,MAAuB;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,UAAU,GACd,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1E,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAExC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QAC7C,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAEpC,MAAM,UAAU,GACd,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,UAAU,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAExC,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC;QAC1D,IAAI,SAAS,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEtC,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QAElC,OAAO,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;YAAE,MAAM;QAC7B,gFAAgF;QAChF,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,SAAS;QACjD,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEnC,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,OAAO;YACrB,eAAe,EAAE,KAAK,CAAC,cAAc;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 /** Root export for @promptci/core */
 export * from './types.js';
-export { scanFiles, parseSections } from './scanner.js';
+export { scanFiles, scanFilesWithAliases, parseSections } from './scanner.js';
+export type { ScanFilesResult } from './scanner.js';
 export { detectProjectType, detectProjectTypeFromContent } from './project-type.js';
 export { detectDuplicates, detectDuplicateHeadings, normalizeSection } from './duplicates.js';
 export { detectConflicts, detectVersionConflicts, detectCompetingTechConflicts } from './conflicts.js';
@@ -12,12 +13,17 @@ export { computeHealthScore, selectTopFixes } from './health-score.js';
 export { generateMarkdownReport, generateJsonReport, writeReport, readHistoryIndex, archiveExistingReport, historyIndexPath, scoreLabel } from './report.js';
 export type { WriteReportOptions, HistoryEntry } from './report.js';
 export { detectManifestConsistency } from './manifest-consistency.js';
+export { detectDependencyStaleness } from './dependency-staleness.js';
 export type { ManifestData } from './manifest-consistency.js';
 export { buildRepoContext, parsePackageJsonFacts } from './repo-context.js';
-export type { RepoContext, PackageJsonFacts, WorkflowFacts, WorkflowCommand } from './repo-context.js';
+export type { RepoContext, PackageJsonFacts, WorkflowFacts, WorkflowCommand, WorkflowSource } from './repo-context.js';
+export type { MakefileFacts } from './makefile.js';
+export { detectActionPinning, extractActionUses } from './action-pinning.js';
 export { runDetectors } from './detectors.js';
 export type { DetectorDefinition } from './detectors.js';
 export { detectSkills } from './skills-detector.js';
+export { detectSkillSupplyChain } from './skill-supply-chain.js';
+export type { SkillSupplyChainRule } from './skill-supply-chain.js';
 export { detectSubagents } from './subagents-detector.js';
 export { detectHooksSettings } from './hooks-settings-detector.js';
 export { detectMcpConfig } from './mcp-config-detector.js';
@@ -35,7 +41,7 @@ export { scan } from './scan.js';
 export { computeFingerprint, createBaseline, filterNewIssues, assertValidBaseline } from './baseline.js';
 export { applyFixRecipe, resolveSafePath, isRepairable } from './fix-engine.js';
 export type { FileChange } from './fix-engine.js';
-export { isWithinRoot, resolveWithinRoot } from './path-containment.js';
+export { isWithinRoot, resolveWithinRoot, realPathWithinRoot, resolveReadableWithinRoot, writeTargetWithinRoot } from './path-containment.js';
 export { optimizeContext } from './context-optimizer.js';
 export type { OptimizeOptions, OptimizeResult } from './context-optimizer.js';
 export { TARGET_MODELS, MODEL_BUDGETS_REVIEW_BY, resolveTargetModel, modelBudget, budgetForTargetModel, } from './model-budgets.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7J,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChF,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGpE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9E,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,YAAY,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC7J,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,YAAY,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvH,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3H,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChF,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9I,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGpE,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -1,6 +1,6 @@
 /** Root export for @promptci/core */
 export * from './types.js';
-export { scanFiles, parseSections } from './scanner.js';
+export { scanFiles, scanFilesWithAliases, parseSections } from './scanner.js';
 export { detectProjectType, detectProjectTypeFromContent } from './project-type.js';
 export { detectDuplicates, detectDuplicateHeadings, normalizeSection } from './duplicates.js';
 export { detectConflicts, detectVersionConflicts, detectCompetingTechConflicts } from './conflicts.js';
@@ -10,9 +10,12 @@ export { parseSuppressions, buildValidationIssues, applySuppressions } from './s
 export { computeHealthScore, selectTopFixes } from './health-score.js';
 export { generateMarkdownReport, generateJsonReport, writeReport, readHistoryIndex, archiveExistingReport, historyIndexPath, scoreLabel } from './report.js';
 export { detectManifestConsistency } from './manifest-consistency.js';
+export { detectDependencyStaleness } from './dependency-staleness.js';
 export { buildRepoContext, parsePackageJsonFacts } from './repo-context.js';
+export { detectActionPinning, extractActionUses } from './action-pinning.js';
 export { runDetectors } from './detectors.js';
 export { detectSkills } from './skills-detector.js';
+export { detectSkillSupplyChain } from './skill-supply-chain.js';
 export { detectSubagents } from './subagents-detector.js';
 export { detectHooksSettings } from './hooks-settings-detector.js';
 export { detectMcpConfig } from './mcp-config-detector.js';
@@ -27,7 +30,7 @@ export { analyzeContext } from './context-analysis.js';
 export { scan } from './scan.js';
 export { computeFingerprint, createBaseline, filterNewIssues, assertValidBaseline } from './baseline.js';
 export { applyFixRecipe, resolveSafePath, isRepairable } from './fix-engine.js';
-export { isWithinRoot, resolveWithinRoot } from './path-containment.js';
+export { isWithinRoot, resolveWithinRoot, realPathWithinRoot, resolveReadableWithinRoot, writeTargetWithinRoot } from './path-containment.js';
 export { optimizeContext } from './context-optimizer.js';
 export { TARGET_MODELS, MODEL_BUDGETS_REVIEW_BY, resolveTargetModel, modelBudget, budgetForTargetModel, } from './model-budgets.js';
 export { loadCustomRules, parseCustomRules, runCustomRules, CustomRulesError, CUSTOM_RULE_TYPES, CUSTOM_RULES_FILE, } from './custom-rules.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7J,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEhF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AACrC,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9E,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE/F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,WAAW,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE7J,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAG5E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE3H,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,gCAAgC,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEhF,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9I,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,kBAAkB,EAClB,WAAW,EACX,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC"}

package/dist/makefile.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Makefile target discovery for the command-validity check (`make <target>`).
+ *
+ * This is a deliberately small reader, not a make implementation. It collects
+ * the explicit targets a Makefile defines (`build:`, `lint test: deps`,
+ * `check::`), the names listed on `.PHONY`, and pattern rules (`%.o: %.c`).
+ * Whenever the file can define targets this reader cannot see — an `include`
+ * / `-include` / `sinclude` directive, or a target name computed from a
+ * variable or function (`$(BIN):`, `$(eval ...)`) — the result is marked
+ * unverifiable and callers must not report anything against it.
+ *
+ * Deterministic and offline: it only reads the Makefile text.
+ */
+export type MakefileFacts = {
+    /** Repo-relative POSIX path of the Makefile read. */
+    file: string;
+    /** Explicit targets and `.PHONY` names. */
+    targets: string[];
+    /** Pattern-rule targets containing `%` (e.g. `%.o`, `build-%`). */
+    patterns: string[];
+    /**
+     * The file can define targets this reader cannot enumerate (`include`,
+     * computed target names, `$(eval)`): never report a target as missing.
+     */
+    unverifiable: boolean;
+};
+/** Parse Makefile text into its targets. Exported for tests. */
+export declare function parseMakefileTargets(content: string, file?: string): MakefileFacts;
+/** True when `target` is defined explicitly or matched by a pattern rule. */
+export declare function makefileDefines(facts: MakefileFacts, target: string): boolean;
+/**
+ * Read the Makefile make would use in a repo-relative directory ('.' = root).
+ * `undefined` when there is none (or it is oversized, unreadable, or a symlink
+ * leaving the repo).
+ */
+export declare function readMakefile(repoRoot: string, dir: string): MakefileFacts | undefined;
+//# sourceMappingURL=makefile.d.ts.map

package/dist/makefile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"makefile.d.ts","sourceRoot":"","sources":["../src/makefile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,MAAM,MAAM,aAAa,GAAG;IAC1B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mEAAmE;IACnE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB,CAAC;AAuBF,gEAAgE;AAChE,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,SAAa,GAAG,aAAa,CAwEtF;AAED,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAY7E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAkBrF"}